Fall back to MokManager if grub failed to validate

If we can't verify grub, fall back to MokManager. This permits shipping a
copy of shim and MokManager without distributing a key, letting
distributions provide their own for user installation.

1 files changed, 4 insertions, 2 deletions

diff --git a/shim.c b/shim.c
index 479007b2..5e718bb0 100644
--- a/shim.c
+++ b/shim.c
@@ -1019,8 +1019,10 @@ EFI_STATUS init_grub(EFI_HANDLE image_handle)
 	efi_status = start_image(image_handle, SECOND_STAGE);
 
 	if (efi_status != EFI_SUCCESS) {
-		Print(L"Failed to start grub\n");
-		goto done;
+		if (efi_status == EFI_ACCESS_DENIED)
+			efi_status = start_image(image_handle, MOK_MANAGER);
+		else
+			Print(L"Failed to start grub\n");
 	}
 done: